---
id: CVE-2026-54566
title: >-
  Markdown Preview Enhanced is a Markdown preview extension for Visual Studio
  Code
summary: >-
  Markdown Preview Enhanced is a Markdown preview extension for Visual Studio
  Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates
  repository-controlled .crossnote/config.js and .crossnote/parser.js files with
  vm.runInNewContext, whi…
severity: high
cvss: 8.5
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-94
vendor: shd101wyy
product: vscode-markdown-preview-enhanced
affected:
  - vscode-markdown-preview-enhanced < 0.8.29
published: '2026-10-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T16:00:33.533'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54566'
references:
  - url: >-
      https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640
    label: security-advisories@github.com
  - url: 'https://github.com/shd101wyy/crossnote/pull/443'
    label: security-advisories@github.com
  - url: 'https://github.com/shd101wyy/crossnote/releases/tag/0.9.30'
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4c
    label: security-advisories@github.com
  - url: 'https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320'
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00296
epssPercentile: 0.22135
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-14T19:44:50.050593Z'
cvssSource: cna
ingestedAt: '2026-10-14T20:53:12.376Z'
---

## Overview

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.